CVE-2023-4053: Full screen notification obscured by external program

Q: What is the severity of CVE-2023-4053?

The severity of CVE-2023-4053 is medium.

Q: Which software is affected by CVE-2023-4053?

Firefox < 116, Firefox ESR < 115.2, and Thunderbird < 115.2 are affected by CVE-2023-4053.

Q: How can an attacker exploit CVE-2023-4053?

An attacker can exploit CVE-2023-4053 by using a URL with a scheme handled by an external program to obscure the full screen notification, leading to user confusion and possible spoofing attacks.

Q: What is the remedy for CVE-2023-4053 in Firefox?

Upgrade Firefox to version 116 or higher to fix CVE-2023-4053.

Q: What is the remedy for CVE-2023-4053 in Thunderbird?

Upgrade Thunderbird to version 115.2 or higher to fix CVE-2023-4053.

Published Aug 1, 2023

Updated

A website could have obscured the full screen notification by using a URL with a scheme handled by an external program, such as a mailto URL. This could have led to user confusion and possible spoofing attacks.

Affected Software

15 affected componentsFixes available

Mozilla Thunderbird<115.2

115.2

Mozilla Firefox<116

116

Mozilla Firefox<116.0

Mozilla Firefox ESR<115.2

115.2

debian/firefox

137.0.1-1

debian/firefox-esr

115.14.0esr-1~deb11u1128.9.0esr-1~deb11u1128.8.0esr-1~deb12u1128.9.0esr-1~deb12u1128.9.0esr-2

debian/thunderbird

1:115.12.0-1~deb11u11:128.9.0esr-1~deb11u11:128.8.0esr-1~deb12u11:128.9.0esr-1~deb12u11:128.9.0esr-1

redhat/firefox<115.2

115.2

redhat/thunderbird<115.2

115.2

alpine/firefox-esr<115.2.0-r0

115.2.0-r0

alpine/firefox-esr<115.2.0-r0

115.2.0-r0

alpine/firefox-esr<115.2.0-r0

115.2.0-r0

alpine/firefox-esr<115.2.0-r0

115.2.0-r0

alpine/firefox-esr<115.2.0-r0

115.2.0-r0

alpine/firefox-esr<115.2.0-r0

115.2.0-r0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Thunderbird to a version that resolves this vulnerability.
Fixed in 115.2
Upgrade
Upgrade Firefox to a version that resolves this vulnerability.
Fixed in 116
Upgrade
Upgrade Firefox ESR to a version that resolves this vulnerability.
Fixed in 115.2
Upgrade
Upgrade debian/firefox to a version that resolves this vulnerability.
Fixed in 137.0.1-1
Upgrade
Upgrade debian/firefox-esr to a version that resolves this vulnerability.
Fixed in 115.14.0esr-1~deb11u1Fixed in 128.9.0esr-1~deb11u1Fixed in 128.8.0esr-1~deb12u1Fixed in 128.9.0esr-1~deb12u1Fixed in 128.9.0esr-2
Upgrade
Upgrade debian/thunderbird to a version that resolves this vulnerability.
Fixed in 1:115.12.0-1~deb11u1Fixed in 1:128.9.0esr-1~deb11u1Fixed in 1:128.8.0esr-1~deb12u1Fixed in 1:128.9.0esr-1~deb12u1Fixed in 1:128.9.0esr-1
Upgrade
Upgrade redhat/firefox to a version that resolves this vulnerability.
Fixed in 115.2
Upgrade
Upgrade redhat/thunderbird to a version that resolves this vulnerability.
Fixed in 115.2

Event History

Aug 1, 2023

CVE Published

via Mozilla·12:00 AM

CVE Published

via MITRE·02:59 PM

Data Sourced

via MITRE·02:59 PM

Description

Data Sourced

via NVD·03:15 PM

DescriptionSeverityWeaknessAffected Software

Data Sourced

via OSV·03:15 PM

DescriptionSeverityAffected Software

Aug 30, 2023

Data Sourced

via Red Hat·09:44 AM

DescriptionSeverityAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Peer vulnerabilities

Found alongside the following vulnerabilities.

Frequently Asked Questions

What is the severity of CVE-2023-4053?

The severity of CVE-2023-4053 is medium.

Which software is affected by CVE-2023-4053?

Firefox < 116, Firefox ESR < 115.2, and Thunderbird < 115.2 are affected by CVE-2023-4053.

How can an attacker exploit CVE-2023-4053?

An attacker can exploit CVE-2023-4053 by using a URL with a scheme handled by an external program to obscure the full screen notification, leading to user confusion and possible spoofing attacks.

What is the remedy for CVE-2023-4053 in Firefox?

Upgrade Firefox to version 116 or higher to fix CVE-2023-4053.

What is the remedy for CVE-2023-4053 in Thunderbird?

Upgrade Thunderbird to version 115.2 or higher to fix CVE-2023-4053.

CVE-2023-4053: Full screen notification obscured by external program

Affected Software

Remediation

Event History

Parent advisories

Peer vulnerabilities

Frequently Asked Questions

What is the severity of CVE-2023-4053?

Which software is affected by CVE-2023-4053?

How can an attacker exploit CVE-2023-4053?

What is the remedy for CVE-2023-4053 in Firefox?

What is the remedy for CVE-2023-4053 in Thunderbird?

Company

Resources

Contact